- Freeradius-Users - lists.freeradius.org

paid help needed
by Radius 08 Jul '05

08 Jul '05

We are requesting bids to fix/install radius to work with version 1.0.4. Since we are not having any luck to get this running and response has been light and too few, and version 1.0.1 on another server just recently decided it didn't want to work correctly with slip when we set up a pass through (And this one was not touched) we are putting out paid request for help to reconfigure our production radius server. It must work with PAP and Chap using /etc/passwd/shadow & mysql database. We also authenticate our slipstream users from the mysql database. If you need to know how the database is laid out you will need to send instruction to get that for you. If we have to start over with database, that is fine also. I also have a mysql dump of the database in backup. There is only 22 users on one mysql database and 6 on the other. So to re-enter the information is not that bid of a deal and can be done very quickly with a pre-written script . We do have the backup text that was used to create the radius database to allow us to disable and enable slipstream and dialup users. All configuration steps need to be handled by email. We have our email to check every three minutes and can be set lower if need be to get job finished in timely manner. If we need to call you to configure this we can after 7:00pm our time to avoid toll charges. Once cost is accepted a new private email address will be provided. We prefer to not provide shell access to our servers. Didn't have to the last year when we hired help here to get our radius installed and working. You have to agree to work with me until finished once started. If you also prefer we can use the escrow service of rentacoder.com is where we get all our programming help, and will post this there also if we need to. We must have 24 hours (weekday) to have system verified as working by our wholesale provider. Thank you and good luck. Thursday night would be a very good time to do this so could be verified by morning.

4 4

MAKEFILE: Regarding the compiling problem of `lrad_crypt_check':
by kkwong1＠sfc.hk 08 Jul '05

08 Jul '05

** Your attention is drawn to the note at the end of this message. ** Hi, Attached codes as below, there exists error in function ' rad_crypt_check' while running MAKE. I have already run the CONFIGURE Do you have any suggestions solving this ? Thanks, Sunny Wog Kai Kwong /usr/include/pthread.h:305: error: parse error before '*' token /usr/include/pthread.h:306: error: parse error before '*' token /usr/include/pthread.h:308: error: parse error before '*' token /usr/include/pthread.h:309: error: parse error before '*' token /usr/include/pthread.h:311: error: parse error before '*' token /usr/include/pthread.h:312: error: parse error before '*' token crypt.c: In function `lrad_crypt_check': crypt.c:60: warning: implicit declaration of function `crypt' crypt.c:60: warning: assignment makes pointer from integer without a cast make[4]: *** [crypt.o] Error 1 make[4]: Leaving directory `/tmp/freeradius-1.0.3/src/lib' make[3]: *** [common] Error 2 make[3]: Leaving directory `/tmp/freeradius-1.0.3/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/tmp/freeradius-1.0.3/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/tmp/freeradius-1.0.3' make: *** [all] Error 2 ______________________________________________________________________ This message is intended only for use of the addressee and may contain information that is privileged and confidential. If you are not the intended recipient, you are hereby notified that any use or dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by reply and delete this message from your system. This email is for information purposes only and is not intended to nor will it create any binding legal relations. Securities and Futures Commission 8th Floor, Chater House 8 Connaught Road Central Hong Kong Website: www.sfc.hk Electronic Investor Resources Centre: www.eirc.hk The URLs of the SFC and eIRC website have been changed from 5 November 2004. Also, the email address of SFC has been renamed from <name>@hksfc.org.hk to <name>@sfc.hk. Although the previous URLs and email address (www.hksfc.org.hk, www.hkeirc.org and <name>@hksfc.org.hk) will remain effective for some time until further notice, you may wish to update your bookmarks and address book.

1 0

triplet data structure
by Sri Ram Bathina 08 Jul '05

08 Jul '05

Hi, I am using freeradius-1.0.3. and Iam using EAP SIM. authentication. i would like to know which data structure is used to store the IMSI, RAND, SRES and KC values. and also which algorithm is used to search when a user sends his sim triplet. Thanks, Sri Ram.

1 0

FreeRadius Authentication
by Hamid Salim 08 Jul '05

08 Jul '05

Hi, I have installed FreeRadius, and would like to know what is the best way to connect with a mobile client using dell AP with the basic configuration. That is no security, encryption etc. Currently, FreeRadius just sits there waiting and i am able to get to the unsecured network without any interference from the server, although AP has been configured to look at the radius server. Second, question is how to enable OpenSSL after FreeRadius has been installed. Thanks. Hamid.

1 0

Re: EAP-TTLS w/ files - cert and username issues]
by jck-freeradius＠southwestern.edu 07 Jul '05

07 Jul '05

On Thu, Jul 07, 2005 at 01:33:31PM -0400, Alan DeKok wrote: > jck-freeradius(a)southwestern.edu wrote: > > I am experiencing several barriers in getting the FreeRadius 1.0.2 > > port to work, in FreeBSD 5.4-RELEASE. The supplicant is XP SP2, > > requesting through a Cisco 1100 AP NAS. > > SP2 ha sknown interoperability problems with RADIUS servers. See > Microsoft's web site for a hot fix. This hotfix is to correct PEAP the Type:Length:Value format. I am doing EAP-TTLS, not PEAP. This raise another question: My Authentication type is: TTLS What should my Authentication Protocol be? I have the choices of MS-CHAP-V2, MD5 or PAP. I am unsure which one is the optimal choice. I am thinking either MS-CHAP-V2 or MD5. Depending on which protocol I select, default_eap_type line in eap.conf need to reflect the protocol (I want to do EAP-TTLS)? > > > When I can get everything working with the built-in XP 802.1x > > authentcation client, I would like to enable multiple VLAN support into my > > radius config. > > Sure. Just send back tunnel attributes. Thanks. I will look into this when I have these other situations handled. > > > Why am I seeing \\username, instead of just username? > > Because that's what the client is sending. Sure, understood. How do I prevent the \\ from happening? I noticed the prefixing of my username with \\ as soon as the supplicant (windows XP) began requesting a "Roaming Identity." I have no idea what this dialog means, and I would like to know how to prevent it from coming up (it seems to be releated to selecting TTLS as my Authentication type). > > > Is there a way to disable the validation of a CA in the built-in > > XP supplicant 802.1x authentication dialog? > > Yes. Uncheck "validate server sertificate". > > Alan DeKok. Thank you for your assistance! > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > --johnk ----- End forwarded message ----- --

2 1

rlm_sqlcounter + PostgreSQL problem
by Miguel Cabrera 07 Jul '05

07 Jul '05

Hi list! I have a problem with the rlm_sqlcounter. It send the Session-Time-Out correctly but when if check the time limit against the data base it always return 0. I've added some debugging output and recompile. This is the output: Tue Jul 5 14:46:51 2005 : Debug: rlm_sqlcounter: Entering module authorize code Tue Jul 5 14:46:51 2005 : Debug: sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}' AND AcctStartTime > abstime(1120539600)' Tue Jul 5 14:46:51 2005 : Debug: radius_xlat: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='ceruno' AND AcctStartTime > abstime(1120539600)' Tue Jul 5 14:46:51 2005 : Debug: sqlcounter_expand: '%{sqlcca3:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='ceruno' AND AcctStartTime > abstime(1120539600)}' Tue Jul 5 14:46:51 2005 : Debug: rlm_sqlcounter: querystr: %{%S:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='ceruno' AND AcctStartTime > abstime(1120539600)} Tue Jul 5 14:46:51 2005 : Debug: rlm_sqlcounter: responsestr: %{sqlcca3:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='ceruno' AND AcctStartTime > abstime(1120539600)} Tue Jul 5 14:46:51 2005 : Debug: rlm_sqlcounter: Valor obtenido de la consulta: 0 Tue Jul 5 14:46:51 2005 : Debug: rlm_sqlcounter: Valor a checkar: 90 Tue Jul 5 14:46:51 2005 : Debug: rlm_sqlcounter: (Check item - counter) is greater than zero Tue Jul 5 14:46:51 2005 : Debug: rlm_sqlcounter: Authorized user ceruno, check_item=90, counter=0 Tue Jul 5 14:46:51 2005 : Debug: rlm_sqlcounter: Sent Reply-Item for user ceruno, Type=Session-Timeout, value=90 Tue Jul 5 14:46:51 2005 : Debug: modsingle[authorize]: returned from dailycounter (rlm_sqlcounter) for request 9 Tue Jul 5 14:46:51 2005 : Debug: modcall[authorize]: module "dailycounter" returns ok for request 9 Tue Jul 5 14:46:51 2005 : Debug: modsingle[authorize]: calling monthlycounter (rlm_sqlcounter) for request 9 Tue Jul 5 14:46:51 2005 : Debug: rlm_sqlcounter: Entering module authorize code Tue Jul 5 14:46:51 2005 : Debug: rlm_sqlcounter: Could not find Check item value pair Tue Jul 5 14:46:51 2005 : Debug: modsingle[authorize]: returned from monthlycounter (rlm_sqlcounter) for request 9 Tue Jul 5 14:46:51 2005 : Debug: modcall[authorize]: module "monthlycounter" returns noop for request 9 Tue Jul 5 14:46:51 2005 : Debug: modcall: group authorize returns ok for request 9 Tue Jul 5 14:46:51 2005 : Debug: rad_check_password: Found Auth-Type System Tue Jul 5 14:46:51 2005 : Debug: auth: type "System" Tue Jul 5 14:46:51 2005 : Debug: Processing the authenticate section of radiusd.conf Tue Jul 5 14:46:51 2005 : Debug: modcall: entering group authenticate for request 9 Tue Jul 5 14:46:51 2005 : Debug: modsingle[authenticate]: calling unix (rlm_unix) for request 9 Tue Jul 5 14:46:51 2005 : Debug: modsingle[authenticate]: returned from unix (rlm_unix) for request 9 Tue Jul 5 14:46:51 2005 : Debug: modcall[authenticate]: module "unix" returns ok for request 9 Tue Jul 5 14:46:51 2005 : Debug: modcall: group authenticate returns ok for request 9 Looking at the code in rlm_sqlcounter.c in the sqlcounter_authorize function (the lines starting with * is what I've added). /* third, wrap query with sql module & expand */ sprintf(querystr, "%%{%%S:%s}", responsestr); sqlcounter_expand(responsestr, MAX_QUERY_LEN, querystr, instance); /* Finally, xlat resulting SQL query */ radius_xlat(querystr, MAX_QUERY_LEN, responsestr, request, NULL); * DEBUG2("rlm_sqlcounter: querystr: %s",querystr); * DEBUG2("rlm_sqlcounter: responsestr: %s",responsestr); counter = atoi(querystr); * DEBUG2("rlm_sqlcounter: Valor obtenido de la consulta: %d",counter); * DEBUG2("rlm_sqlcounter: Valor a checkar: %d",check_vp->lvalue); If you compare the output above you will note that when 'counter = atoi(querystr)' happens the value of querystr is : ' %{%S:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='ceruno' AND AcctStartTime > abstime(1120539600)}' . So I think is maybe a bug. I also have a question: Where the SQL query really happens? I couldn't figure it out :( I'am runnig in a FC3 with PostgreSQL 7.4.8 and the last stable release of freeRadius. (Version 1.0.4) I'll appreciate any help you can give me. Miguel.

4 8

router & freeradius
by Felice Pizzurro 07 Jul '05

07 Jul '05

Hi, I have made a access control to wired & wireless network by freeradius and openldap base on attribute radiusGroupName. Now, I want to reserve at one group only the access to the web (port 80), and to another group the full access to Internet. It's possible to manage this control by freeradius and LDAP. thanks, Felice -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: Niente paura, da oggi puoi recuperare i dati persi dal PC, semplice come cliccare qui Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=3361&d=7-7

2 1

EAP-TTLS w/ files - cert and username issues
by jck-freeradius＠southwestern.edu 07 Jul '05

07 Jul '05

List, I am experiencing several barriers in getting the FreeRadius 1.0.2 port to work, in FreeBSD 5.4-RELEASE. The supplicant is XP SP2, requesting through a Cisco 1100 AP NAS. Included is my startup, along with a couple of supplicant requests. In the past I have used sql authorization. I now use files, and am taking baby-steps (with http://www.alphacore.net/spipen/article.php3?id_article=4 as my guide). When I can get everything working with the built-in XP 802.1x authentcation client, I would like to enable multiple VLAN support into my radius config. My questions can be found at the bottom of this post. --- /usr/local/sbin/radiusd -X -A -y -z Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = yes main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/demoCA/private/cakey.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cacert.pem" tls: CA_file = "/usr/local/etc/raddb/certs/cacert.pem" tls: private_key_password = "xXxXxX" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = yes ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1645 Listening on accounting *:1646 Listening on proxy *:1647 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.249:1645, id=204, length=160 User-Name = "\\test" Framed-MTU = 1400 Called-Station-Id = "0014.691e.dee0" Calling-Station-Id = "000e.35b5.eb8f" Service-Type = Login-User Message-Authenticator = 0x238c744d504314eab835667ae645baac EAP-Message = 0x0205001115800000000715030100020230 NAS-Port-Type = Wireless-802.11 NAS-Port = 5109 State = 0x9b473d358960d6200af1bc554cb69e61 NAS-IP-Address = 192.168.1.249 NAS-Identifier = "freeradius1100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "\test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 5 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 0 modcall: group authenticate returns invalid for request 0 auth: Failed to validate the user. Login incorrect: [\\test/<no User-Password attribute>] (from client Aironet1100 port 5109 cli 000e.35b5.eb8f) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 204 to 192.168.1.249:1645 Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.1.249:1645, id=205, length=135 User-Name = "\\test" Framed-MTU = 1400 Called-Station-Id = "0014.691e.dee0" Calling-Station-Id = "000e.35b5.eb8f" Service-Type = Login-User Message-Authenticator = 0x8fa769b77767a6d40c0f4368065836f7 EAP-Message = 0x0201000a015c74657374 NAS-Port-Type = Wireless-802.11 NAS-Port = 5110 NAS-IP-Address = 192.168.1.249 NAS-Identifier = "freeradius1100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707 modcall[authorize]: module "auth_log" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "\test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 205 to 192.168.1.249:1645 EAP-Message = 0x010200160410f8699c142f2b04174aa12d7ba7e1acb3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefbab3f23eae914a7e7e787f980a33ea Finished request 1 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.1.249:1645, id=206, length=149 User-Name = "\\test" Framed-MTU = 1400 Called-Station-Id = "0014.691e.dee0" Calling-Station-Id = "000e.35b5.eb8f" Service-Type = Login-User Message-Authenticator = 0x028ca873c46d637a9313e8a7c400e9f9 EAP-Message = 0x020200060315 NAS-Port-Type = Wireless-802.11 NAS-Port = 5110 State = 0xefbab3f23eae914a7e7e787f980a33ea NAS-IP-Address = 192.168.1.249 NAS-Identifier = "freeradius1100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707 modcall[authorize]: module "auth_log" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "\test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/ttls rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 206 to 192.168.1.249:1645 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x92217acdcb66585c00578271b16e607a Finished request 2 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.1.249:1645, id=207, length=249 User-Name = "\\test" Framed-MTU = 1400 Called-Station-Id = "0014.691e.dee0" Calling-Station-Id = "000e.35b5.eb8f" Service-Type = Login-User Message-Authenticator = 0x2720f14be41136a09d19c7eccb60cfe9 EAP-Message = 0x0203006a158000000060160301005b01000057030142cd0f6a8f09262c8c4b8acc2ac7d156e44e412a5860a00d23512d0ea279941000003000390038003500160013000a00330032002f0066000500040065006400630062006000150012000900140011000800030100 NAS-Port-Type = Wireless-802.11 NAS-Port = 5110 State = 0x92217acdcb66585c00578271b16e607a NAS-IP-Address = 192.168.1.249 NAS-Identifier = "freeradius1100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707 modcall[authorize]: module "auth_log" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "\test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 106 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 005b], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0454], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 207 to 192.168.1.249:1645 EAP-Message = 0x0104040a15c0000004b1160301004a02000046030142ccc10ed21fab0d59b10e6188e109574dae7147d68ffb41d3d2023030eeda75207f4a0ac74177d7255e411ecedbe3ebc5db188d491a11923c4cffb6354b0b32fb00350016030104540b00045000044d00044a30820446308203afa003020102020900b4ffbc458a823a63300d06092a864886f70d01010405003081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572 EAP-Message = 0x204469766973696f6e3129302706035504031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d696e40736f7574687765737465726e2e656475301e170d3035303730363133353630335a170d3135303730343133353630335a3081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572204469766973696f6e3129302706035504 EAP-Message = 0x031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d696e40736f7574687765737465726e2e65647530819f300d06092a864886f70d010101050003818d0030818902818100952a6e25e986e7297e0fe23d8ab71a410a827faeed95c076d4bb558f46790b556c13bb40cb082da6776bcad9d70c884d7f831dce00b984cc2c1818a744c529c21a9fb708244e09ef55c7edc2c063659d0ab8f2948bcf9e98c862460023c17a5ce91ed97429e6a79e2726c11c8acbbf109f12f4a8d8efcea365a5831944dc14250203010001a38201323082012e301d0603551d EAP-Message = 0x0e04160414166b7bb5824d8888245b04f718d44f9d85d631783081fe0603551d230481f63081f38014166b7bb5824d8888245b04f718d44f9d85d63178a181cfa481cc3081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572204469766973696f6e3129302706035504031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d69 EAP-Message = 0x6e40736f7574687765737465726e2e656475820900b4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2509db5459d6466c777ef4f8e39fe7bc Finished request 3 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.1.249:1645, id=208, length=149 User-Name = "\\test" Framed-MTU = 1400 Called-Station-Id = "0014.691e.dee0" Calling-Station-Id = "000e.35b5.eb8f" Service-Type = Login-User Message-Authenticator = 0xdbea76e625c3741e8a7a40e97aab42c3 EAP-Message = 0x020400061500 NAS-Port-Type = Wireless-802.11 NAS-Port = 5110 State = 0x2509db5459d6466c777ef4f8e39fe7bc NAS-IP-Address = 192.168.1.249 NAS-Identifier = "freeradius1100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707 modcall[authorize]: module "auth_log" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "\test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 208 to 192.168.1.249:1645 EAP-Message = 0x010500bb1580000004b1ffbc458a823a63300c0603551d13040530030101ff300d06092a864886f70d01010405000381810030b2ae584f5f190289bcf3451bc1d1bac6a0e9d7ad7d79857c1b68c4537677fc2cc9192f4e5a17b974bdbb514f94178847884da765e4b3f3e878e0d9083978cd799b434f25e6f7fa8047d6bef2f410919f2d54574a873f1adafb83a175ccc47d34c46113fbc80fa0942cc9b74fe4fbbfed0c632eea7a4ba04ab80913169a289216030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb976af42b5c24fda517ca5a5094e5bd1 Finished request 4 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.1.249:1645, id=209, length=160 User-Name = "\\test" Framed-MTU = 1400 Called-Station-Id = "0014.691e.dee0" Calling-Station-Id = "000e.35b5.eb8f" Service-Type = Login-User Message-Authenticator = 0x1ed15ed6d0d7cefc891b19b23bee81de EAP-Message = 0x0205001115800000000715030100020230 NAS-Port-Type = Wireless-802.11 NAS-Port = 5110 State = 0xb976af42b5c24fda517ca5a5094e5bd1 NAS-IP-Address = 192.168.1.249 NAS-Identifier = "freeradius1100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707 modcall[authorize]: module "auth_log" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "\test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A 74089:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48 74089:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 5 modcall: group authenticate returns reject for request 5 auth: Failed to validate the user. Login incorrect: [\\test/<no User-Password attribute>] (from client Aironet1100 port 5110 cli 000e.35b5.eb8f) Delaying request 5 for 1 seconds Finished request 5 Going to the next request Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 204 with timestamp 42ccc10c Sending Access-Reject of id 209 to 192.168.1.249:1645 EAP-Message = 0x04050004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 2 seconds... rad_recv: Access-Request packet from host 192.168.1.249:1645, id=210, length=135 User-Name = "\\test" Framed-MTU = 1400 Called-Station-Id = "0014.691e.dee0" Calling-Station-Id = "000e.35b5.eb8f" Service-Type = Login-User Message-Authenticator = 0x544e7a1be19c6f73f27f99568ad64107 EAP-Message = 0x0201000a015c74657374 NAS-Port-Type = Wireless-802.11 NAS-Port = 5111 NAS-IP-Address = 192.168.1.249 NAS-Identifier = "freeradius1100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707 modcall[authorize]: module "auth_log" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "\test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 1 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 210 to 192.168.1.249:1645 EAP-Message = 0x0102001604102175e07d9aa780427053303ac2cde45c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x63ae08507e7adbd6ec0a1b963ba8ac19 Finished request 6 Going to the next request Waking up in 2 seconds... rad_recv: Access-Request packet from host 192.168.1.249:1645, id=211, length=149 User-Name = "\\test" Framed-MTU = 1400 Called-Station-Id = "0014.691e.dee0" Calling-Station-Id = "000e.35b5.eb8f" Service-Type = Login-User Message-Authenticator = 0x9ca188d4e2c3bacf6951c2e146d7793b EAP-Message = 0x020200060315 NAS-Port-Type = Wireless-802.11 NAS-Port = 5111 State = 0x63ae08507e7adbd6ec0a1b963ba8ac19 NAS-IP-Address = 192.168.1.249 NAS-Identifier = "freeradius1100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707 modcall[authorize]: module "auth_log" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "\test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/ttls rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 Sending Access-Challenge of id 211 to 192.168.1.249:1645 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd9af635c0f0a743e30cb4b7cfcb6dbb3 Finished request 7 Going to the next request Waking up in 2 seconds... rad_recv: Access-Request packet from host 192.168.1.249:1645, id=212, length=249 User-Name = "\\test" Framed-MTU = 1400 Called-Station-Id = "0014.691e.dee0" Calling-Station-Id = "000e.35b5.eb8f" Service-Type = Login-User Message-Authenticator = 0xa6def1b9db8aef9d09c89013ae6291cd EAP-Message = 0x0203006a158000000060160301005b01000057030142cd0f6ecc689e8295b1c859d9fa1226f5b025ac75bb01b1c1d27fc659c6a89500003000390038003500160013000a00330032002f0066000500040065006400630062006000150012000900140011000800030100 NAS-Port-Type = Wireless-802.11 NAS-Port = 5111 State = 0xd9af635c0f0a743e30cb4b7cfcb6dbb3 NAS-IP-Address = 192.168.1.249 NAS-Identifier = "freeradius1100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707 modcall[authorize]: module "auth_log" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "\test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 3 length 106 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 005b], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0454], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 8 modcall: group authenticate returns handled for request 8 Sending Access-Challenge of id 212 to 192.168.1.249:1645 EAP-Message = 0x0104040a15c0000004b1160301004a02000046030142ccc1121988c9add3c5d8fe81cf66d5b075cdd1eb288ce2abcaef53a530f9b5205b04e5b1f6ba59f700f87ecb2710de52422884b1f67ea9fefce9b3350df8c17f00350016030104540b00045000044d00044a30820446308203afa003020102020900b4ffbc458a823a63300d06092a864886f70d01010405003081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572 EAP-Message = 0x204469766973696f6e3129302706035504031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d696e40736f7574687765737465726e2e656475301e170d3035303730363133353630335a170d3135303730343133353630335a3081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572204469766973696f6e3129302706035504 EAP-Message = 0x031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d696e40736f7574687765737465726e2e65647530819f300d06092a864886f70d010101050003818d0030818902818100952a6e25e986e7297e0fe23d8ab71a410a827faeed95c076d4bb558f46790b556c13bb40cb082da6776bcad9d70c884d7f831dce00b984cc2c1818a744c529c21a9fb708244e09ef55c7edc2c063659d0ab8f2948bcf9e98c862460023c17a5ce91ed97429e6a79e2726c11c8acbbf109f12f4a8d8efcea365a5831944dc14250203010001a38201323082012e301d0603551d EAP-Message = 0x0e04160414166b7bb5824d8888245b04f718d44f9d85d631783081fe0603551d230481f63081f38014166b7bb5824d8888245b04f718d44f9d85d63178a181cfa481cc3081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572204469766973696f6e3129302706035504031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d69 EAP-Message = 0x6e40736f7574687765737465726e2e656475820900b4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x164cf9a732e840475264604a9e01de91 Finished request 8 Going to the next request Waking up in 2 seconds... rad_recv: Access-Request packet from host 192.168.1.249:1645, id=213, length=149 User-Name = "\\test" Framed-MTU = 1400 Called-Station-Id = "0014.691e.dee0" Calling-Station-Id = "000e.35b5.eb8f" Service-Type = Login-User Message-Authenticator = 0x2709d031c3b73506b88e0453e2ec0c39 EAP-Message = 0x020400061500 NAS-Port-Type = Wireless-802.11 NAS-Port = 5111 State = 0x164cf9a732e840475264604a9e01de91 NAS-IP-Address = 192.168.1.249 NAS-Identifier = "freeradius1100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707 modcall[authorize]: module "auth_log" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "\test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 9 modcall: group authorize returns updated for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 9 modcall: group authenticate returns handled for request 9 Sending Access-Challenge of id 213 to 192.168.1.249:1645 EAP-Message = 0x010500bb1580000004b1ffbc458a823a63300c0603551d13040530030101ff300d06092a864886f70d01010405000381810030b2ae584f5f190289bcf3451bc1d1bac6a0e9d7ad7d79857c1b68c4537677fc2cc9192f4e5a17b974bdbb514f94178847884da765e4b3f3e878e0d9083978cd799b434f25e6f7fa8047d6bef2f410919f2d54574a873f1adafb83a175ccc47d34c46113fbc80fa0942cc9b74fe4fbbfed0c632eea7a4ba04ab80913169a289216030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x473d358960d6204ce25ca24599a0f7f7 Finished request 9 Going to the next request Waking up in 2 seconds... rad_recv: Access-Request packet from host 192.168.1.249:1645, id=214, length=160 User-Name = "\\test" Framed-MTU = 1400 Called-Station-Id = "0014.691e.dee0" Calling-Station-Id = "000e.35b5.eb8f" Service-Type = Login-User Message-Authenticator = 0xe05d2ac8b90eacb717ad47ed3afe6f8c EAP-Message = 0x0205001115800000000715030100020230 NAS-Port-Type = Wireless-802.11 NAS-Port = 5111 State = 0x473d358960d6204ce25ca24599a0f7f7 NAS-IP-Address = 192.168.1.249 NAS-Identifier = "freeradius1100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 10 modcall[authorize]: module "preprocess" returns ok for request 10 radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707 modcall[authorize]: module "auth_log" returns ok for request 10 modcall[authorize]: module "chap" returns noop for request 10 modcall[authorize]: module "mschap" returns noop for request 10 rlm_realm: No '@' in User-Name = "\test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 10 rlm_eap: EAP packet type response id 5 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 10 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 10 modcall: group authorize returns updated for request 10 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 10 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A 74089:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48 74089:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 10 modcall: group authenticate returns reject for request 10 auth: Failed to validate the user. Login incorrect: [\\test/<no User-Password attribute>] (from client Aironet1100 port 5111 cli 000e.35b5.eb8f) Delaying request 10 for 1 seconds Finished request 10 Going to the next request Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 205 with timestamp 42ccc10e Cleaning up request 2 ID 206 with timestamp 42ccc10e Cleaning up request 3 ID 207 with timestamp 42ccc10e Cleaning up request 4 ID 208 with timestamp 42ccc10e Cleaning up request 5 ID 209 with timestamp 42ccc10e Sending Access-Reject of id 214 to 192.168.1.249:1645 EAP-Message = 0x04050004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.1.249:1645, id=215, length=135 User-Name = "\\test" Framed-MTU = 1400 Called-Station-Id = "0014.691e.dee0" Calling-Station-Id = "000e.35b5.eb8f" Service-Type = Login-User Message-Authenticator = 0x9b1598a18cc60ddc9fd92daaf7b78b3b EAP-Message = 0x0201000a015c74657374 NAS-Port-Type = Wireless-802.11 NAS-Port = 5112 NAS-IP-Address = 192.168.1.249 NAS-Identifier = "freeradius1100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 11 modcall[authorize]: module "preprocess" returns ok for request 11 radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707 modcall[authorize]: module "auth_log" returns ok for request 11 modcall[authorize]: module "chap" returns noop for request 11 modcall[authorize]: module "mschap" returns noop for request 11 rlm_realm: No '@' in User-Name = "\test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 11 rlm_eap: EAP packet type response id 1 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 11 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 11 modcall: group authorize returns updated for request 11 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 11 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 11 modcall: group authenticate returns handled for request 11 Sending Access-Challenge of id 215 to 192.168.1.249:1645 EAP-Message = 0x010200160410ae56ef5b513719784eb029ef161e3834 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x47b6bb0eb7cb3629f5209d838c9cb2bb Finished request 11 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.1.249:1645, id=216, length=149 User-Name = "\\test" Framed-MTU = 1400 Called-Station-Id = "0014.691e.dee0" Calling-Station-Id = "000e.35b5.eb8f" Service-Type = Login-User Message-Authenticator = 0xf8cbc78444e069e76dcfdc85d3d68e1c EAP-Message = 0x020200060315 NAS-Port-Type = Wireless-802.11 NAS-Port = 5112 State = 0x47b6bb0eb7cb3629f5209d838c9cb2bb NAS-IP-Address = 192.168.1.249 NAS-Identifier = "freeradius1100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 12 modcall[authorize]: module "preprocess" returns ok for request 12 radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707 modcall[authorize]: module "auth_log" returns ok for request 12 modcall[authorize]: module "chap" returns noop for request 12 modcall[authorize]: module "mschap" returns noop for request 12 rlm_realm: No '@' in User-Name = "\test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 12 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 12 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 12 modcall: group authorize returns updated for request 12 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 12 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/ttls rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 12 modcall: group authenticate returns handled for request 12 Sending Access-Challenge of id 216 to 192.168.1.249:1645 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcefd256444122da46c97de73b47f9968 Finished request 12 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.1.249:1645, id=217, length=249 User-Name = "\\test" Framed-MTU = 1400 Called-Station-Id = "0014.691e.dee0" Calling-Station-Id = "000e.35b5.eb8f" Service-Type = Login-User Message-Authenticator = 0xeee120ea8fb84b5b68ba7b01669c1a90 EAP-Message = 0x0203006a158000000060160301005b01000057030142cd0f70429a566d1ac989f1550ae3a440b7d4e9db1779f5e5288babe6e987cd00003000390038003500160013000a00330032002f0066000500040065006400630062006000150012000900140011000800030100 NAS-Port-Type = Wireless-802.11 NAS-Port = 5112 State = 0xcefd256444122da46c97de73b47f9968 NAS-IP-Address = 192.168.1.249 NAS-Identifier = "freeradius1100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 13 modcall[authorize]: module "preprocess" returns ok for request 13 radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707 modcall[authorize]: module "auth_log" returns ok for request 13 modcall[authorize]: module "chap" returns noop for request 13 modcall[authorize]: module "mschap" returns noop for request 13 rlm_realm: No '@' in User-Name = "\test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 13 rlm_eap: EAP packet type response id 3 length 106 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 13 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 13 modcall: group authorize returns updated for request 13 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 13 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 005b], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0454], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 13 modcall: group authenticate returns handled for request 13 Sending Access-Challenge of id 217 to 192.168.1.249:1645 EAP-Message = 0x0104040a15c0000004b1160301004a02000046030142ccc114fe81831a72e96a50f4c01c76f5410e5a4bdd3403910a23fe69681500209efd56cbe5f05cf20e7379e49dcef61940bbda94da905fbc49ee2f9f955b579000350016030104540b00045000044d00044a30820446308203afa003020102020900b4ffbc458a823a63300d06092a864886f70d01010405003081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572 EAP-Message = 0x204469766973696f6e3129302706035504031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d696e40736f7574687765737465726e2e656475301e170d3035303730363133353630335a170d3135303730343133353630335a3081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572204469766973696f6e3129302706035504 EAP-Message = 0x031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d696e40736f7574687765737465726e2e65647530819f300d06092a864886f70d010101050003818d0030818902818100952a6e25e986e7297e0fe23d8ab71a410a827faeed95c076d4bb558f46790b556c13bb40cb082da6776bcad9d70c884d7f831dce00b984cc2c1818a744c529c21a9fb708244e09ef55c7edc2c063659d0ab8f2948bcf9e98c862460023c17a5ce91ed97429e6a79e2726c11c8acbbf109f12f4a8d8efcea365a5831944dc14250203010001a38201323082012e301d0603551d EAP-Message = 0x0e04160414166b7bb5824d8888245b04f718d44f9d85d631783081fe0603551d230481f63081f38014166b7bb5824d8888245b04f718d44f9d85d63178a181cfa481cc3081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572204469766973696f6e3129302706035504031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d69 EAP-Message = 0x6e40736f7574687765737465726e2e656475820900b4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab124225e8f965bd03e617abbd82f8fa Finished request 13 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.1.249:1645, id=218, length=149 User-Name = "\\test" Framed-MTU = 1400 Called-Station-Id = "0014.691e.dee0" Calling-Station-Id = "000e.35b5.eb8f" Service-Type = Login-User Message-Authenticator = 0x0e840d4a507bc45feebe4dd29d555499 EAP-Message = 0x020400061500 NAS-Port-Type = Wireless-802.11 NAS-Port = 5112 State = 0xab124225e8f965bd03e617abbd82f8fa NAS-IP-Address = 192.168.1.249 NAS-Identifier = "freeradius1100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 14 modcall[authorize]: module "preprocess" returns ok for request 14 radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707 modcall[authorize]: module "auth_log" returns ok for request 14 modcall[authorize]: module "chap" returns noop for request 14 modcall[authorize]: module "mschap" returns noop for request 14 rlm_realm: No '@' in User-Name = "\test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 14 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 14 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 14 modcall: group authorize returns updated for request 14 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 14 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 14 modcall: group authenticate returns handled for request 14 Sending Access-Challenge of id 218 to 192.168.1.249:1645 EAP-Message = 0x010500bb1580000004b1ffbc458a823a63300c0603551d13040530030101ff300d06092a864886f70d01010405000381810030b2ae584f5f190289bcf3451bc1d1bac6a0e9d7ad7d79857c1b68c4537677fc2cc9192f4e5a17b974bdbb514f94178847884da765e4b3f3e878e0d9083978cd799b434f25e6f7fa8047d6bef2f410919f2d54574a873f1adafb83a175ccc47d34c46113fbc80fa0942cc9b74fe4fbbfed0c632eea7a4ba04ab80913169a289216030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbb33623ddc8707a12f36fa8892364757 Finished request 14 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.1.249:1645, id=219, length=160 User-Name = "\\test" Framed-MTU = 1400 Called-Station-Id = "0014.691e.dee0" Calling-Station-Id = "000e.35b5.eb8f" Service-Type = Login-User Message-Authenticator = 0xf394bff1a421b25724d257be2378166e EAP-Message = 0x0205001115800000000715030100020230 NAS-Port-Type = Wireless-802.11 NAS-Port = 5112 State = 0xbb33623ddc8707a12f36fa8892364757 NAS-IP-Address = 192.168.1.249 NAS-Identifier = "freeradius1100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 15 modcall[authorize]: module "preprocess" returns ok for request 15 radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707 modcall[authorize]: module "auth_log" returns ok for request 15 modcall[authorize]: module "chap" returns noop for request 15 modcall[authorize]: module "mschap" returns noop for request 15 rlm_realm: No '@' in User-Name = "\test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 15 rlm_eap: EAP packet type response id 5 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 15 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 15 modcall: group authorize returns updated for request 15 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 15 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A 74089:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48 74089:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 15 modcall: group authenticate returns reject for request 15 auth: Failed to validate the user. Login incorrect: [\\test/<no User-Password attribute>] (from client Aironet1100 port 5112 cli 000e.35b5.eb8f) Delaying request 15 for 1 seconds Finished request 15 Going to the next request Waking up in 4 seconds... --- My questions are the following: - I choose EAP-TTLS because the client needs no additional certificates, and it works well under Windows as it does under Mac. User-Name = "\\test" Why am I seeing \\username, instead of just username? Does this have something to do with "Roaming Profile"? If it does, how do I disable roaming profile from within the XP 802.1x authentication dialog. Can this be corrected with a better understanding of how to strip usernames? Using radtest generates a Request-Accept packet, working fine. - I created my SSL cert using CA.pl (prior use was with CA.all). I am using a self signed cert. Why do I see the following: TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A 74089:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48 74089:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode Is there a way to disable the validation of a CA in the built-in XP supplicant 802.1x authentication dialog? Is that what is causing my problem, a non-trusted CA certificate? Sincerely, --johnk ----- End forwarded message ----- --

2 1

etc_smbpasswd authentication failed
by Ramses van Pinxteren 07 Jul '05

07 Jul '05

Hi all! I am trying to authenticate against a smbpasswd file with freeradius-1.0.1 on a fedora core 3 machine. When I start radius in debug mode, it shows me that authentication is progressing perfect (modcall: group authorize returns ok for request 0) However it still returns a accept-reject package. I have the funny feeling I did miss a line somewhere in the radius.conf file. Here is the console output. btw I started radius with with # radiusd -sfxxyz -l stdout Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded DIGEST Module: Instantiated digest (digest) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded attr_filter attr_filter: attrsfile = "/etc/raddb/attrs" rlm_attr_filter: Authorize method will be deprecated. Module: Instantiated attr_filter (attr_filter) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded passwd passwd: filename = "/etc/samba/smbpasswd" passwd: format = "*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::" passwd: authtype = "MS-CHAP" passwd: delimiter = ":" passwd: ignorenislike = no passwd: ignoreempty = yes passwd: allowmultiplekeys = no passwd: hashsize = 100 rlm_passwd: nfields: 7 keyfield 0(User-Name) listable: no Module: Instantiated passwd (etc_smbpasswd) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32769, id=43, length=55 User-Name = "dkr" User-Password = "sleutel" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/127.0.0.1/auth-detail-20050706' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20050706 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "attr_filter" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 users: Matched DEFAULT at 152 modcall[authorize]: module "files" returns ok for request 0 rlm_passwd: Added LM-Password: '84ECA50B0BFCDCBEAAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: '6CC3E48E5B94C5FABEA360744435FBF4' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items rlm_passwd: Adding "Auth-Type = MS-CHAP" modcall[authorize]: module "etc_smbpasswd" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: group authenticate returns notfound for request 0 auth: Failed to validate the user. Login incorrect: [dkr/sleutel] (from client localhost port 1) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 43 to 127.0.0.1:32769 Waking up in 4 seconds...

2 3

NAS TABLE
by Velikanov 07 Jul '05

07 Jul '05

Good Day. I used freeradius-1.0.2 and Oracle with table NAS in Oracle. Everything was OK. But in freeradius-snapshot-20050624 I got such error: ................... rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT id,nasname,shortname,type,secret FROM nas rlm_sql (sql): Reserving sql socket id: 14 rlm_sql (sql): nasname of length 19 is greater than the allowed maximum of 3 rlm_sql (sql): nasname of length 7 is greater than the allowed maximum of 3 rlm_sql (sql): nasname of length 19 is greater than the allowed maximum of 3 rlm_sql (sql): nasname of length 19 is greater than the allowed maximum of 3 rlm_sql (sql): nasname of length 19 is greater than the allowed maximum of 3 rlm_sql (sql): nasname of length 19 is greater than the allowed maximum of 3 rlm_sql (sql): nasname of length 21 is greater than the allowed maximum of 3 rlm_sql (sql): nasname of length 19 is greater than the allowed maximum of 3 .......................

2 1